index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("17bd8fda268cbb009508c014b7c0ff9d8284f850","78cd4dfb251b21b53592322570cc32c6678aa468","91568d7a82cc7677f6b13f11bea5c40cf12d281b","0bec69c1b22603e9a385495fbe94700ac36b28e5","5ed22c0033aed380aa154e672e8db3a2d4c195c4","cb25a5125fb353496b59b910263209f273f3552d","994e3f5dd082f5d82f9cc84108a60d359910ba79","f6793243ad20359d8be40d3accac168a15a327fb","b2f955b3e6107f831ebe67997f8586d4fe9f3e98")
